JevGrep (Arifette)

How we reviewed this: we built it in Docker on Node 24, ran its test suite, pointed inspect at a tree seeded with realistic credential files to see what it would and would not send, then enabled remote evaluation and ran a real search against the API.

What it does

JevGrep answers “where is this behaviour implemented?” for a coding agent. It parses the repository into fragments, scores every eligible fragment against your question, and returns the original excerpts with paths and line numbers — as a CLI or as an MCP server. The agent then reads those files itself.

$ jevgrep search --query 'Where is session expiry handled?'
jevgrep: complete
coverage: scope . | files 3/3 eligible | 3 fragments | coverage complete

1 excerpt

src/session.ts:1-7 score 0.91
export function isExpired(session: { createdAt: number; ttlMs: number }, now = Date.now()) {
  return now - session.createdAt > session.ttlMs;
}

Excerpts are verbatim source, not a summary, which is the right output for something feeding an agent that will open the file next.

Nothing leaves until you say so

This is the part worth copying. jevgrep init writes a profile outside the repository, stores the credential separately, and creates the project with remote evaluation switched off:

authorized JevGrep project
configuration: /root/.config/jevgrep/profiles/repo-816fc349d3/config.json
provider: TypeSafe AI
remote evaluation: disabled
next: jevgrep inspect; review the configuration before enabling remote_evaluation_enabled

inspect then tells you what a search would cost before one exists:

files              5 eligible of 7 discovered, 0 unreadable
  excluded by reason:
    credential_file: 1
    credential_pattern: 1
estimated scan     1 provider request(s), ~800 input tokens
remote evaluation  disabled
note               remote evaluation is disabled: a search would be refused before any excerpt leaves this machine

A tool that ships “off”, prints its own scope and estimate, and makes you edit a file to enable the network is the exception here, not the rule.

What its filters catch, and what they don’t

We ran the same tree we used on jegrep, one realistic credential file per directory:

file	JevGrep
config/service-account-key.pem	excluded — credential_file
config/service-account-key.json	excluded — credential_pattern
config/my-project-4f3a1c.json (a service-account key)	eligible
deploy/aws_credentials.txt	eligible
deploy/kubeconfig	eligible
src/app.rs	eligible, as intended

Better than the tools we have tested before it — the -key.json pattern is caught, where a name list alone misses it — and still, three files whose contents are credentials are eligible to be sent. The README says so itself: “Credential filters cannot detect every secret; add repository-specific exclusions in .jevgrepignore”.

That honesty is worth something, and the .jevgrepignore it creates for you is the place to fix it. But this is now the fourth project in the directory where the filter is a list of names and the leak is a file named something else. A check on the first few kilobytes of content — BEGIN PRIVATE KEY, "type": "service_account", aws_secret_access_key, client-key-data — would close the class, and the bytes are already being read.

Engineering

415 tests, 412 passing and 3 skipped, in a CI job named offline-checks — the name is a claim about what the tests need, and it holds: nothing in the suite reaches the network. Exit codes are documented per command (0 complete, 2 rejected, 3 partial, 4 fatal, 130 interrupted), --scope refuses absolute paths and traversal, and a partial scan is refused unless you pass --allow-partial.

The budget accounting is unusually explicit. Responses are measured in reference tokens with the tokenizer version printed (tiktoken@1.0.22/cl100k_base), the human view and the JSON payload are budgeted separately, and inspect refuses to produce a dollar figure at all when no dated pricing record is configured — “so no USD estimate is produced” rather than a guess. We have read a lot of cost estimates in this directory; this is the first one that declines to make one up.

Maintenance

Created 20 September, thirty commits, MIT, published as @nassim-arifette/jevgrep 0.1.0, CI green, one author. Providers are TypeSafe, Vercel AI Gateway or OpenRouter, chosen at init, and the credential is named by the profile rather than read from whatever happens to be in the environment.

Verdict

The most carefully-gated tool we have reviewed: off by default, scoped, estimated, and honest about what its filters cannot do. If you want an agent to find code by behaviour rather than by name, this is the one to try first.

Before you enable remote evaluation, run inspect, then spend five minutes on .jevgrepignore for anything in your tree that holds a credential but is not named like one — the default list will not catch it.

For the same job in Rust with a three-pass cascade see jegrep; for a line-by-line filter, semgrep and jgrep.

See how it compares with other tools in Best Jev tools, tested hands-on.

Review updated Sep 21, 2026. Numbers quoted from the project are its author's own; we don't publish our own measurements of Jev.